Skip to content

Commit 2a37eaf

Browse files
GackoGacko
committed
NGINX: Bump to OpenResty v1.27.1.2.
1 parent 039edcd commit 2a37eaf

9 files changed

+741
-19
lines changed

‎images/nginx/rootfs/build.sh

Lines changed: 16 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -32,20 +32,20 @@ export MORE_HEADERS_VERSION=v0.37
3232
# Check for recent changes: https://github.com/atomx/nginx-http-auth-digest/compare/v1.0.0...master
3333
export NGINX_DIGEST_AUTH=v1.0.0
3434

35-
# Check for recent changes: https://github.com/SpiderLabs/ModSecurity-nginx/compare/v1.0.3...master
36-
export MODSECURITY_VERSION=v1.0.3
35+
# Check for recent changes: https://github.com/SpiderLabs/ModSecurity-nginx/compare/v1.0.4...master
36+
export MODSECURITY_VERSION=v1.0.4
3737

3838
# Check for recent changes: https://github.com/SpiderLabs/ModSecurity/compare/v3.0.14...v3/master
3939
export MODSECURITY_LIB_VERSION=v3.0.14
4040

41-
# Check for recent changes: https://github.com/coreruleset/coreruleset/compare/v4.10.0...main
42-
export OWASP_MODSECURITY_CRS_VERSION=v4.10.0
41+
# Check for recent changes: https://github.com/coreruleset/coreruleset/compare/v4.15.0...main
42+
export OWASP_MODSECURITY_CRS_VERSION=v4.15.0
4343

44-
# Check for recent changes: https://github.com/openresty/lua-nginx-module/compare/v0.10.27...master
45-
export LUA_NGX_VERSION=v0.10.27
44+
# Check for recent changes: https://github.com/openresty/lua-nginx-module/compare/v0.10.28...master
45+
export LUA_NGX_VERSION=v0.10.28
4646

47-
# Check for recent changes: https://github.com/openresty/stream-lua-nginx-module/compare/v0.0.15...master
48-
export LUA_STREAM_NGX_VERSION=v0.0.15
47+
# Check for recent changes: https://github.com/openresty/stream-lua-nginx-module/compare/v0.0.16...master
48+
export LUA_STREAM_NGX_VERSION=v0.0.16
4949

5050
# Check for recent changes: https://github.com/openresty/lua-upstream-nginx-module/compare/v0.07...master
5151
export LUA_UPSTREAM_VERSION=v0.07
@@ -56,17 +56,17 @@ export LUA_CJSON_VERSION=2.1.0.14
5656
# Check for recent changes: https://github.com/leev/ngx_http_geoip2_module/compare/445df24ef3781e488cee3dfe8a1e111997fc1dfe...master
5757
export GEOIP2_VERSION=445df24ef3781e488cee3dfe8a1e111997fc1dfe
5858

59-
# Check for recent changes: https://github.com/openresty/luajit2/compare/v2.1-20240815...v2.1-agentzh
60-
export LUAJIT_VERSION=v2.1-20240815
59+
# Check for recent changes: https://github.com/openresty/luajit2/compare/v2.1-20250117...v2.1-agentzh
60+
export LUAJIT_VERSION=v2.1-20250117
6161

6262
# Check for recent changes: https://github.com/openresty/lua-resty-balancer/compare/v0.05...master
6363
export LUA_RESTY_BALANCER=v0.05
6464

6565
# Check for recent changes: https://github.com/openresty/lua-resty-lrucache/compare/v0.15...master
6666
export LUA_RESTY_CACHE=v0.15
6767

68-
# Check for recent changes: https://github.com/openresty/lua-resty-core/compare/v0.1.30...master
69-
export LUA_RESTY_CORE=v0.1.30
68+
# Check for recent changes: https://github.com/openresty/lua-resty-core/compare/v0.1.31...master
69+
export LUA_RESTY_CORE=v0.1.31
7070

7171
# Check for recent changes: https://github.com/cloudflare/lua-resty-cookie/compare/f418d77082eaef48331302e84330488fdc810ef4...master
7272
export LUA_RESTY_COOKIE_VERSION=f418d77082eaef48331302e84330488fdc810ef4
@@ -95,17 +95,17 @@ export LUA_RESTY_REDIS_VERSION=v0.31
9595
# Check for recent changes: https://github.com/api7/lua-resty-ipmatcher/compare/3e93c53eb8c9884efe939ef070486a0e507cc5be...master
9696
export LUA_RESTY_IPMATCHER_VERSION=3e93c53eb8c9884efe939ef070486a0e507cc5be
9797

98-
# Check for recent changes: https://github.com/microsoft/mimalloc/compare/v2.1.9...master
99-
export MIMALOC_VERSION=v2.1.9
98+
# Check for recent changes: https://github.com/microsoft/mimalloc/compare/v2.2.4...main
99+
export MIMALOC_VERSION=v2.2.4
100100

101101
# Check for recent changes: https://github.com/open-telemetry/opentelemetry-cpp/compare/v1.18.0...main
102102
export OPENTELEMETRY_CPP_VERSION=v1.18.0
103103

104104
# Check for recent changes: https://github.com/open-telemetry/opentelemetry-proto/compare/v1.5.0...main
105105
export OPENTELEMETRY_PROTO_VERSION=v1.5.0
106106

107-
# Check for recent changes: https://github.com/nginx/njs/compare/0.8.10...master
108-
export NJS_VERSION=0.8.10
107+
# Check for recent changes: https://github.com/nginx/njs/compare/0.9.0...master
108+
export NJS_VERSION=0.9.0
109109

110110
export BUILD_PATH=/tmp/build
111111

‎images/nginx/rootfs/patches/05_nginx-1.27.1-stream_ssl_preread_no_skip.patch

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,15 @@
11
diff --git a/src/stream/ngx_stream_ssl_preread_module.c b/src/stream/ngx_stream_ssl_preread_module.c
2-
index e3d11fd9..3717b5fe 100644
2+
index 3fc83ff2f..7e65d65be 100644
33
--- a/src/stream/ngx_stream_ssl_preread_module.c
44
+++ b/src/stream/ngx_stream_ssl_preread_module.c
5-
@@ -159,7 +159,7 @@ ngx_stream_ssl_preread_handler(ngx_stream_session_t *s)
5+
@@ -190,11 +190,11 @@ ngx_stream_ssl_preread_handler(ngx_stream_session_t *s)
6+
}
7+
8+
if (rc == NGX_OK) {
9+
- return ngx_stream_ssl_preread_servername(s, &ctx->host);
10+
+ rc = ngx_stream_ssl_preread_servername(s, &ctx->host);
11+
}
612

7-
rc = ngx_stream_ssl_preread_parse_record(ctx, p, p + len);
813
if (rc != NGX_AGAIN) {
914
- return rc;
1015
+ return rc == NGX_OK ? NGX_DECLINED : rc;

‎images/nginx/rootfs/patches/28_nginx-1.27.1-CVE-2025-23419.patch

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
diff --git a/src/http/ngx_http_request.c b/src/http/ngx_http_request.c
2+
index 3cca57cf5..9593b7fb5 100644
3+
--- a/src/http/ngx_http_request.c
4+
+++ b/src/http/ngx_http_request.c
5+
@@ -932,6 +932,31 @@ ngx_http_ssl_servername(ngx_ssl_conn_t *ssl_conn, int *ad, void *arg)
6+
goto done;
7+
}
8+
9+
+ sscf = ngx_http_get_module_srv_conf(cscf->ctx, ngx_http_ssl_module);
10+
+
11+
+#if (defined TLS1_3_VERSION \
12+
+ && !defined LIBRESSL_VERSION_NUMBER && !defined OPENSSL_IS_BORINGSSL)
13+
+
14+
+ /*
15+
+ * SSL_SESSION_get0_hostname() is only available in OpenSSL 1.1.1+,
16+
+ * but servername being negotiated in every TLSv1.3 handshake
17+
+ * is only returned in OpenSSL 1.1.1+ as well
18+
+ */
19+
+
20+
+ if (sscf->verify) {
21+
+ const char *hostname;
22+
+
23+
+ hostname = SSL_SESSION_get0_hostname(SSL_get0_session(ssl_conn));
24+
+
25+
+ if (hostname != NULL && ngx_strcmp(hostname, servername) != 0) {
26+
+ c->ssl->handshake_rejected = 1;
27+
+ *ad = SSL_AD_ACCESS_DENIED;
28+
+ return SSL_TLSEXT_ERR_ALERT_FATAL;
29+
+ }
30+
+ }
31+
+
32+
+#endif
33+
+
34+
hc->ssl_servername = ngx_palloc(c->pool, sizeof(ngx_str_t));
35+
if (hc->ssl_servername == NULL) {
36+
goto error;
37+
@@ -945,8 +970,6 @@ ngx_http_ssl_servername(ngx_ssl_conn_t *ssl_conn, int *ad, void *arg)
38+
39+
ngx_set_connection_log(c, clcf->error_log);
40+
41+
- sscf = ngx_http_get_module_srv_conf(hc->conf_ctx, ngx_http_ssl_module);
42+
-
43+
c->ssl->buffer_size = sscf->buffer_size;
44+
45+
if (sscf->ssl.ctx) {
46+
diff --git a/src/stream/ngx_stream_ssl_module.c b/src/stream/ngx_stream_ssl_module.c
47+
index ba444776a..6dee106de 100644
48+
--- a/src/stream/ngx_stream_ssl_module.c
49+
+++ b/src/stream/ngx_stream_ssl_module.c
50+
@@ -521,12 +521,35 @@ ngx_stream_ssl_servername(ngx_ssl_conn_t *ssl_conn, int *ad, void *arg)
51+
goto done;
52+
}
53+
54+
+ sscf = ngx_stream_get_module_srv_conf(cscf->ctx, ngx_stream_ssl_module);
55+
+
56+
+#if (defined TLS1_3_VERSION \
57+
+ && !defined LIBRESSL_VERSION_NUMBER && !defined OPENSSL_IS_BORINGSSL)
58+
+
59+
+ /*
60+
+ * SSL_SESSION_get0_hostname() is only available in OpenSSL 1.1.1+,
61+
+ * but servername being negotiated in every TLSv1.3 handshake
62+
+ * is only returned in OpenSSL 1.1.1+ as well
63+
+ */
64+
+
65+
+ if (sscf->verify) {
66+
+ const char *hostname;
67+
+
68+
+ hostname = SSL_SESSION_get0_hostname(SSL_get0_session(ssl_conn));
69+
+
70+
+ if (hostname != NULL && ngx_strcmp(hostname, servername) != 0) {
71+
+ c->ssl->handshake_rejected = 1;
72+
+ *ad = SSL_AD_ACCESS_DENIED;
73+
+ return SSL_TLSEXT_ERR_ALERT_FATAL;
74+
+ }
75+
+ }
76+
+
77+
+#endif
78+
+
79+
s->srv_conf = cscf->ctx->srv_conf;
80+
81+
ngx_set_connection_log(c, cscf->error_log);
82+
83+
- sscf = ngx_stream_get_module_srv_conf(s, ngx_stream_ssl_module);
84+
-
85+
if (sscf->ssl.ctx) {
86+
if (SSL_set_SSL_CTX(ssl_conn, sscf->ssl.ctx) == NULL) {
87+
goto error;

‎images/nginx/rootfs/patches/28_nginx-1.27.1-upstream_timeout_fields.patch renamed to ‎images/nginx/rootfs/patches/29_nginx-1.27.1-upstream_timeout_fields.patch

File renamed without changes.

‎images/nginx/rootfs/patches/29_nginx-1.27.1-safe_resolver_ipv6_option.patch renamed to ‎images/nginx/rootfs/patches/30_nginx-1.27.1-safe_resolver_ipv6_option.patch

File renamed without changes.

‎images/nginx/rootfs/patches/30_nginx-1.27.1-socket_cloexec.patch renamed to ‎images/nginx/rootfs/patches/31_nginx-1.27.1-socket_cloexec.patch

File renamed without changes.

‎images/nginx/rootfs/patches/31_nginx-1.27.1-reuseport_close_unused_fds.patch renamed to ‎images/nginx/rootfs/patches/32_nginx-1.27.1-reuseport_close_unused_fds.patch

File renamed without changes.

‎images/nginx/rootfs/patches/32_nginx-1.27.1-proc_exit_handler.patch renamed to ‎images/nginx/rootfs/patches/33_nginx-1.27.1-proc_exit_handler.patch

File renamed without changes.

0 commit comments

Comments
 (0)